Bangladesh PDPO 2025: Implications for Biometric Access Control & CCTV Systems

Bangladesh's Personal Data Protection Ordinance 2025 — referred to throughout this guide as PDPO 2025 — represents the most significant change to data governance in Bangladesh in a generation. Gazetted in 2025, it establishes a legal framework for how organisations collect, store, process, and share personal data about individuals. If your organisation uses biometric access control systems (fingerprint readers, facial recognition terminals, iris scanners) or CCTV cameras that capture identifiable images of people, PDPO 2025 directly applies to you.

This is not a future concern. The ordinance is in effect. Organisations that continue to operate biometric and CCTV systems without addressing PDPO 2025 requirements face regulatory penalties from the designated supervisory authority and civil claims from data subjects whose rights have been violated. This guide explains what the ordinance requires and how to bring your systems into compliance.

What Is PDPO 2025?

PDPO 2025 is a comprehensive data protection law modelled on international frameworks including the European Union's General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act 2023. It applies to any organisation — public or private — that processes personal data about individuals in Bangladesh.

"Processing" is defined broadly. It includes collecting, recording, storing, using, sharing, disclosing, erasing, or destroying personal data. Running a CCTV system that records images of people is processing. Registering employees' fingerprints in an access control system is processing. Using facial recognition to match people against a database is processing.

The ordinance establishes several foundational principles that govern all processing activities:

Lawfulness, Fairness, and Transparency: You must have a legal basis for collecting personal data, process it fairly, and be transparent with data subjects about what you collect and why.
Purpose Limitation: Data collected for one purpose cannot be used for another incompatible purpose without fresh consent or legal authority.
Data Minimisation: Collect only the data that is necessary for your stated purpose — no more.
Storage Limitation: Keep personal data only for as long as necessary for the purpose, then delete it.
Integrity and Confidentiality: Protect personal data from unauthorised access, disclosure, or destruction.

Key Definitions You Need to Know

Personal Data

PDPO 2025 defines personal data broadly as any information that relates to an identified or identifiable natural person. This includes a person's name, photograph, ID number, location data, biometric data, and any combination of data that together can identify a person. CCTV footage that captures a person's face is personal data. An access log that records which employee entered which room at what time is personal data.

Sensitive Personal Data

The ordinance creates a higher-protection category of "sensitive personal data." Sensitive personal data includes:

Biometric data used for identification purposes (fingerprints, facial scans, iris patterns, voice prints)
Health and medical data
Genetic data
Financial data
Religious or political beliefs
Data concerning children

Biometric access control data is explicitly sensitive personal data. Processing it requires not just a lawful basis, but a specific condition that justifies processing data in this higher-risk category. The conditions are more limited than for ordinary personal data.

Data Controller and Data Processor

Your organisation, as the entity that determines why and how biometric and CCTV data is collected, is a data controller. If you engage a third party (for example, a monitoring company that watches your CCTV feeds) they become a data processor. Controllers have direct legal obligations under PDPO 2025. Processors must operate under a written contract with the controller that includes specific data protection terms.

Biometric Access Control: What PDPO 2025 Requires

Lawful Basis for Collecting Biometric Data

You cannot collect employees' fingerprints or facial scans simply because it is convenient. PDPO 2025 requires a lawful basis. For employment-related biometric data, the most relevant bases are:

Legitimate interests: The employer has a legitimate interest in controlling access to secure areas, and this interest is not overridden by the employee's rights and freedoms. This can justify biometric access control for genuinely secure areas such as server rooms, cash vaults, or laboratories.
Legal obligation: Where a regulation (such as Bangladesh Bank ICT Guideline v4.0) explicitly requires biometric access control, compliance with that legal obligation provides a lawful basis.
Consent: For biometric data, consent must be freely given, specific, informed, and withdrawable. Consent from employees is problematic because the power imbalance in employment relationships means consent may not be truly free. Relying on consent alone for mandatory access control biometrics is not recommended.

Data Minimisation in Practice

PDPO 2025's data minimisation principle means you should capture and store only what is necessary for the access control purpose. In practice:

Store only the biometric template (the mathematical representation used for matching) — not the original fingerprint image, unless you have a specific reason to keep the image
Register employees only for the access zones they actually need — do not enrol everyone in every zone
Do not use access control biometric data for other purposes such as payroll attendance without specific policy and disclosure

Most modern access control systems store templates rather than images by default. Verify that your system is configured this way. ZKTeco, Suprema, and Honeywell access control systems can be configured to store templates only — check your system configuration if you are uncertain.

Storage and Retention Limits

Access control biometric data must be deleted when it is no longer necessary. Practical retention triggers include:

Employee departure from the organisation: delete biometric template within a defined period (we recommend 30 days, giving time for final settlements and any disputes to surface)
Contractor or visitor biometric enrolment: delete immediately upon project completion or last access
Periodic reviews: conduct annual reviews of all enrolled persons to identify and delete records for individuals no longer requiring access

Retain access logs (who entered where and when) for the period required by your security policy and applicable regulations (Bangladesh Bank requires 180 days for bank premises). But the biometric template itself should be purged on the schedule above.

Employee Notice and Transparency

Even where consent is not the lawful basis, PDPO 2025 requires transparency. Before you enrol employees in a biometric access control system, you must inform them in writing:

What biometric data you are collecting (fingerprint, face, iris)
Why you are collecting it (access control to specific areas)
How long you will keep it
Who has access to it
Their rights under PDPO 2025
Who your designated data protection contact is

This notice must be in a language the employee understands. For most Bangladeshi workforces, Bangla-language privacy notices are required alongside English versions.

CCTV Systems: What PDPO 2025 Requires

Notice Requirements: Signage

PDPO 2025 requires that individuals are informed when they are in a CCTV-monitored area. The standard mechanism is clearly visible signage at the entrance to monitored areas. The signage must state:

That CCTV is in operation
The name of the organisation operating it
A contact point for inquiries about the CCTV system
How long footage is retained

Small signage that is not clearly visible, or no signage at all, is a violation. For a commercial building or factory, every public entrance must have compliant CCTV notice signage. Employee areas require signage at area entrances.

Footage Retention Limits

PDPO 2025 requires that personal data — including CCTV footage — is not kept longer than necessary for the purpose for which it was collected. For most organisations, CCTV is operated for security and incident investigation purposes.

A defensible retention period is 30 days for routine commercial premises (retail, offices, commercial real estate). Organisations subject to sector-specific regulations with longer retention requirements (such as Bangladesh Bank's 90-day requirement for bank branches) should retain for the regulatory minimum and no longer. Retaining footage indefinitely, or for periods far longer than any plausible investigation need, violates the storage limitation principle.

Document your retention policy and enforce it technically — configure your NVR or VMS to automatically overwrite footage older than your retention period. This technical enforcement protects you by demonstrating that the policy is implemented, not just stated.

Access Controls on Footage

CCTV footage is personal data and must be protected. PDPO 2025 requires appropriate technical and organisational measures to prevent unauthorised access. For CCTV systems, this means:

Password-protected access to the NVR or VMS — different credentials for different staff, not a shared password known to everyone
Role-based access controls: guards see live feeds but cannot export footage; security managers can review and export; IT administrators can manage the system but should not be able to delete specific footage
Audit logs showing who accessed the system and when
Secure transmission: encrypted network connections for remote viewing (HTTPS, encrypted VPN — not plain HTTP)
Physical access controls on the NVR/VMS server room

Cross-Border Transfer Restrictions

If your CCTV system uploads footage or management data to cloud servers located outside Bangladesh, PDPO 2025 restricts this transfer. Cross-border transfers of personal data are only permitted to countries with adequate data protection frameworks, or where the organisation has put in place appropriate safeguards such as contractual clauses. Notify your cloud service provider and verify where data is stored. Many international VMS cloud platforms host data in Singapore or the EU — your legal team should confirm whether these transfers are compliant.

Data Subject Rights Under PDPO 2025

Individuals whose data you process have enforceable rights under PDPO 2025:

Right of Access: A person can request to know whether you hold personal data about them and receive a copy. If an employee or visitor asks whether their biometric template is still in your access control system, you must be able to answer and, on request, confirm what data you hold.

Right of Correction: Individuals can request correction of inaccurate personal data. This is most relevant for access control systems where identity records may contain errors.

Right of Erasure: Individuals can request deletion of their personal data in certain circumstances — for example, when it is no longer necessary for the original purpose. A former employee requesting deletion of their biometric template after leaving is exercising this right.

Right to Withdraw Consent: Where processing is based on consent, the individual can withdraw consent at any time. Your system must support the ability to delete a biometric enrolment and revoke access promptly.

Organisations must have a process for receiving, logging, and responding to data subject requests within the timeframes specified by PDPO 2025 (typically 30 days).

Penalties for Non-Compliance

PDPO 2025 establishes a tiered penalty structure. The supervisory authority — a designated government body — can impose:

Administrative fines for procedural violations (failure to maintain records, failure to respond to data subject requests)
Substantial monetary penalties for serious violations such as unlawful processing of sensitive personal data, failure to implement adequate security measures, or cross-border transfers without appropriate safeguards
Criminal penalties in cases of deliberate or reckless violations

The ordinance also creates a civil right of action — individuals can bring claims for compensation where PDPO 2025 violations have caused them material or non-material damage. This is a significant risk for organisations processing large quantities of biometric data, such as banks, factories, and large offices.

How to Update Your Systems for PDPO 2025 Compliance

We recommend a systematic approach to bringing your biometric and CCTV systems into compliance:

Step 1: Audit Your Current Systems — Document every biometric system and every CCTV installation you operate. Record what data is collected, where it is stored, who has access, and current retention settings.

Step 2: Review Lawful Bases — For each biometric system, confirm the lawful basis for processing. Prepare the documentation to demonstrate it.

Step 3: Prepare Privacy Notices — Draft employee-facing notices covering biometric access control data. Draft CCTV notices (for signage) for all monitored areas.

Step 4: Configure Technical Controls — Update NVR/VMS retention settings. Implement role-based access controls. Enable audit logging. Review cloud storage arrangements.

Step 5: Establish Data Subject Rights Processes — Create a process for receiving and responding to access, correction, and erasure requests within regulatory timeframes.

Step 6: Review and Update Vendor Contracts — Ensure that any third party processing your CCTV or biometric data (monitoring companies, cloud providers, AMC contractors with remote access) is operating under a PDPO-compliant data processing agreement.

Get Free Consultation

PDPO 2025 compliance for physical security systems is technical and legal work. We help organisations across Bangladesh review their biometric and CCTV systems against PDPO 2025 requirements and implement the technical changes needed for compliance.

Get Free Consultation — contact us to arrange a PDPO 2025 readiness review for your biometric access control and CCTV systems.